Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Eric Snowberg <eric.snowberg@oracle.com>
To:     jarkko@kernel.org, zohar@linux.ibm.com
Cc:     dhowells@redhat.com, dwmw2@infradead.org,
        herbert@gondor.apana.org.au, davem@davemloft.net,
        dmitry.kasatkin@gmail.com, paul@paul-moore.com, jmorris@namei.org,
        serge@hallyn.com, pvorel@suse.cz, noodles@fb.com, tiwai@suse.de,
        eric.snowberg@oracle.com, kanth.ghatraju@oracle.com,
        konrad.wilk@oracle.com, erpalmer@linux.vnet.ibm.com,
        coxu@redhat.com, keyrings@vger.kernel.org,
        linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org,
        linux-integrity@vger.kernel.org,
        linux-security-module@vger.kernel.org
Subject: [PATCH v3 04/10] KEYS: X.509: Parse Key Usage
Date:   Tue, 13 Dec 2022 19:33:55 -0500
Message-Id: <20221214003401.4086781-5-eric.snowberg@oracle.com>
In-Reply-To: <20221214003401.4086781-1-eric.snowberg@oracle.com>
References: <20221214003401.4086781-1-eric.snowberg@oracle.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?4arNmP6968AcoW5VJpKZxPaow9Nc/CcnHAXtP28hicbvZf81par/Be1BewUM?=
 =?us-ascii?Q?Cd/HgrpDmJYQwYlfkguAxF57PIc/IzKIjRjW6DpuQlkyDFC2zxKzzHjnE+wW?=
 =?us-ascii?Q?htu11GsuP+IsVMrjM3v4NxosaEoCaDxrTNT7eW8RHcq9+SZfotv3j0RS9s+E?=
 =?us-ascii?Q?GOJG4mNCobxJbwY/6xm2nHQ6VFaHn3N+wNPM9JG4pAsqTmvW+v+7GE6ul0Ph?=
 =?us-ascii?Q?IudrHb9fw0c0YXUhTKXRc4RPKCWuB80q4IXf1AL7Jaqh4hqM+cgXOFajm/Rg?=
 =?us-ascii?Q?Y6jTHRBtZ3gaRWcLTeJMbe0fEsV0HKOrj8lJOZU1Ga9fnzzY3ZRUIJ+eJojk?=
 =?us-ascii?Q?QCPLvDoat0E3SB5ATxnVhDo+iW7BSRORMEvyKgMWRiVEpWgGdoeRxGz5wS2i?=
 =?us-ascii?Q?vqyeq/BU0sUIWwWrNmA4PhKlAECp1hbwFUtfKBuvx56v/+kEP5g09rPag2b8?=
 =?us-ascii?Q?OeQ/+is+vkRSFuReEp3qXsUB3l1K9Mi9a7SHHBzA9E7A4gOCRYKjmMu84aNQ?=
 =?us-ascii?Q?1s05BH0WycNJhfsoaTFiSw/xNNtdbugHaGq6wtOWv2bREjKLahYugbccv2Gn?=
 =?us-ascii?Q?bNYIuyzsSjtjuWbyCRyphJXlI3sfMwaWrZBmI/Auv2+bIhvqiVH6oCr2YFbZ?=
 =?us-ascii?Q?Y3x+ArBql4nqasZbXraE7wd/VVSr572qugzOw+W2HzaEiVFjmJPQtUdFYje1?=
 =?us-ascii?Q?pt6aVNRdtriiyWM1gbaPDOzZffw2d5UsbETRrten62BeXUMd/Zjal3Q9ShYg?=
 =?us-ascii?Q?wTz7t6yjQ+2i0IhVbSYazWN+CiQHCaA88XZduYOgecGU2cwmnYE0UjsqiFZr?=
 =?us-ascii?Q?E9Sy7j4zjs7L/6nZ4fitD+RKBTj7KFeKvyvRcuKsJHavQaneXOB1Wy0Pa+eY?=
 =?us-ascii?Q?yjEOLYAekSCj2fEm/UHn5xGPMOJahEBHNTy4sf7JctdvgM0z8U6AmUpirFVz?=
 =?us-ascii?Q?qQIo/jvgGSw0rddetKJwEGC0Fa/3a+tS2IJ/C+XJ520xEvrooxLKEZNJaK4c?=
 =?us-ascii?Q?dzxKZBX5DyuqeDTeNZsoGx8QuZ/WPqCqfsb7plegOUqHOkpHj1etzl8mnXcu?=
 =?us-ascii?Q?JgKk8e6gmzJFIAIo1RWY7gf5spP42TMRH3A0PbdQGWOMkRm0usAyZEInvXYU?=
 =?us-ascii?Q?G2DuuT0unq8Qdty6+MzIGbmyEUR6fcLDJldexOxCTgDsOLFdXrntENgOAyZn?=
 =?us-ascii?Q?RV8TDsJCoea6TCiLUjTNdPGZJMsQUEo1RNPux1NNpIIspRe/W9uAPdjp1pFq?=
 =?us-ascii?Q?WiBcK03fUmmnCmd45BnUyLNwGCA3zdIb0NcHmbF6A3f6n9ExllAQvk7mvafy?=
 =?us-ascii?Q?yxruhHL9mdaCEwUTPPpPo5JnTzUH5FrYJA0GPlbVbNXy9xGMSBKNm6wa1vxT?=
 =?us-ascii?Q?gZ+a8nk6aUxdto/iaG9m7TW96d5iB93VCtl1YWdQWrDZpOlj3YryPHP8KMgj?=
 =?us-ascii?Q?btAKJuhU8urTnjGCQpLgLRU6qGLhkZgF6t2odCNikKeDM+m0W9ZdbGog34uZ?=
 =?us-ascii?Q?xj2w/r+EaGOSpgFUzPDbDvP8UtTrTjZuz2f6STq1z9ay406Tp+NEnBccM+Jm?=
 =?us-ascii?Q?6/Iiuu3cnJog+3+n23bGVIQ6SajDnj50SanIwMJmfCnXyumtJcWhUBcijl5i?=
 =?us-ascii?Q?76ujeXptCq1YKPutjIPHvD8=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 9d6dab43-6efe-40c1-79c5-08dadd6ae8dc
X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Dec 2022 00:34:07.2196
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: Loex+q1E6cSlnBmYXrZ3+EgXIQn/KUKjAiPIrm8rx0UXoDkwe2NL7+Rflng84RFgdB71edmZ4tAukmopgVf0VB7O8EnKLR53wvXDf+lA+y8=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN0PR10MB5223
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.923,Hydra:6.0.545,FMLib:17.11.122.1
 definitions=2022-12-13_03,2022-12-13_01,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 suspectscore=0 bulkscore=0
 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 malwarescore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2212070000
 definitions=main-2212140002
X-Proofpoint-GUID: 87Zir4qgRiO9kE8gFd_WczHPZ09GHpZ7
X-Proofpoint-ORIG-GUID: 87Zir4qgRiO9kE8gFd_WczHPZ09GHpZ7
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org

Parse the X.509 Key Usage.  The key usage extension defines the purpose of
the key contained in the certificate.

   id-ce-keyUsage OBJECT IDENTIFIER ::=  { id-ce 15 }

      KeyUsage ::= BIT STRING {
           digitalSignature        (0),
           contentCommitment       (1),
           keyEncipherment         (2),
           dataEncipherment        (3),
           keyAgreement            (4),
           keyCertSign             (5),
           cRLSign                 (6),
           encipherOnly            (7),
           decipherOnly            (8) }

If the keyCertSign is set, store it in the x509_certificate structure.
This will be used in a follow on patch that requires knowing the
certificate key usage type.

Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
---
 crypto/asymmetric_keys/x509_cert_parser.c | 22 ++++++++++++++++++++++
 crypto/asymmetric_keys/x509_parser.h      |  1 +
 2 files changed, 23 insertions(+)

diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
index b4443e507153..edb22cf04eed 100644
--- a/crypto/asymmetric_keys/x509_cert_parser.c
+++ b/crypto/asymmetric_keys/x509_cert_parser.c
@@ -579,6 +579,28 @@ int x509_process_extension(void *context, size_t hdrlen,
 		return 0;
 	}
 
+	if (ctx->last_oid == OID_keyUsage) {
+		/*
+		 * Get hold of the keyUsage bit string to validate keyCertSign
+		 * v[1] is the encoding size
+		 *       (Expect either 0x02 or 0x03, making it 1 or 2 bytes)
+		 * v[2] is the number of unused bits in the bit string
+		 *       (If >= 3 keyCertSign is missing)
+		 * v[3] and possibly v[4] contain the bit string
+		 * 0x04 is where KeyCertSign lands in this bit string (from
+		 *      RFC 5280 4.2.1.3)
+		 */
+		if (v[0] != ASN1_BTS)
+			return -EBADMSG;
+		if (vlen < 4)
+			return -EBADMSG;
+		if (v[1] == 0x02 && v[2] <= 2 && (v[3] & 0x04))
+			ctx->cert->kcs_set = true;
+		else if (vlen > 4 && v[1] == 0x03 && (v[3] & 0x04))
+			ctx->cert->kcs_set = true;
+		return 0;
+	}
+
 	if (ctx->last_oid == OID_authorityKeyIdentifier) {
 		/* Get hold of the CA key fingerprint */
 		ctx->raw_akid = v;
diff --git a/crypto/asymmetric_keys/x509_parser.h b/crypto/asymmetric_keys/x509_parser.h
index 7c5c0ad1c22e..74a9f929e400 100644
--- a/crypto/asymmetric_keys/x509_parser.h
+++ b/crypto/asymmetric_keys/x509_parser.h
@@ -39,6 +39,7 @@ struct x509_certificate {
 	bool		unsupported_sig;	/* T if signature uses unsupported crypto */
 	bool		blacklisted;
 	bool		root_ca;		/* T if basic constraints CA is set */
+	bool		kcs_set;		/* T if keyCertSign is set */
 };
 
 /*
-- 
2.27.0